Just a rumour of a bug is enough to find a security exploit these days

Bots now react to patches faster than humans

Anil Madhavapeddy, a Cambridge researcher and OCaml compiler maintainer, warns of a fundamental shift in cybersecurity. According to his experience, attempts to exploit a vulnerability in OCaml projects appear within ten minutes of a patch or discussion being published. Previously, this delay lasted days or weeks. The increased traffic is also confirmed by the maintainer of the rclone tool, who is suddenly dealing with over forty reports instead of the usual two per month.

The end of public embargoes for open source

The changing dynamics radically impact how the open source community operates. The traditional model (where a bug is found, a fix is written, the community discusses it for a few days, and GitHub assigns a CVE identifier in the meantime) is breaking down. If automated systems and bots constantly monitor public repositories and can reconstruct an exploit path from a mere hint (like a commit title or a pull request discussion), the public preparation of patches becomes a risk.

The agent doesn't guarantee quality, but increases volume

The acceleration of bug detection has two sides. On the one hand, bots flood repository maintainers with automatically generated reports (often without a deeper understanding of the problem). Even though rclone reports that about 75% of them contain at least something relevant, triaging these reports requires a massive amount of human time. Developers paradoxically have to deploy AI tools themselves just to keep up with filtering reports from foreign AIs.

The race for a new bug reporting system

The current situation is unsustainable. If it takes GitHub three to four weeks to assign a CVE, while AI needs ten minutes to understand a vulnerability, the process must speed up. Communities will have to build private channels for sharing fixes before pushing them to the main branch, and find a way to automatically filter the flood of generated reports from bounty hunters.

Lilith's verdict

The issue isn't about code being less secure. It is the moment when transparent open source culture collided hard with machines that don't need to sleep and read every commit in real time.